PRIVACY NOTICE
Last Updated:
Educational Computer Systems,
Inc., a Global Payments company, ("ECSI,"
"us", "we" or "our") respects your rights and
preferences regarding data privacy. In this Privacy Notice
("Notice"), we describe how we collect, use, disclose, and dispose of
the personal information that we collect from users of our U.S. websites,
forums and blogs ("Sites") that link to this Notice, as well as from
our U.S. prospects and customers and their personnel.
Please note that this Notice
does not describe our processing of borrower personal information in
connection with our provision of student loan processing services. If you are a
borrower, and your loan is serviced by ECSI, you should refer to the separate
privacy notice available here. That separate notice
describes the personal information that we collect and process about you as a
borrower, as well as whether and when we disclose that personal information,
and what rights you may have with respect to such disclosure.
ECSI also maintains specific
privacy notices for job applicants, employees, and contractors through Global
Payments, Inc. If you are a job applicant, employee, or contractor and need a
copy of the applicable privacy notice, please contact us at privacy@globalpay.com.
In this Notice, we provide
the following information about our collection and processing of personal
information from and about users of our Sites, as well as our U.S. prospects
and customers and their personnel:
●
PERSONAL INFORMATION WE
COLLECT AND HOW WE USE IT
●
HOW WE DISCLOSE
PERSONAL INFORMATION
●
TRANSFERRING PERSONAL
INFORMATION GLOBALLY
●
DATA SECURITY AND DATA
RETENTION
●
COOKIES AND OTHER
TRACKING TECHNOLOGIES
●
CHILDREN
“Personal information” is
information that identifies or relates to an identifiable individual. Subject
to your consent if required by law, we may collect the following types of
personal information about you:
● Basic Identifying Information, including your full name, postal
address, e-mail address, phone number, username or other account credentials,
or other similar identifiers.
● Device Information and Other Unique Identifiers, including device
identifier, internet protocol (IP) address, cookies, pixel tags, or similar
unique identifiers.
● Internet or Other Network Activity, including browsing or search
history and information regarding your interactions with our Sites.
● Commercial Information, including information about the
products and services we provide to you, your access and purchase history, and
other information about your commercial activity.
● Professional and Employment-Related Information, including your role or
status with the school or other organization with which you are
affiliated.
● Information You Provide, including your communications with
us and any other content you provide (such as if you report a problem or
otherwise engage with our Sites).
● Audio and Visual Information, including videos and recordings of
your voice (such as when we record calls or videos for quality assurance or
other business activities).
●
Create, maintain or provide service for your account
●
Process or fulfill requests from you
●
Respond to customer service requests from you
●
Verify your information
●
Process payments
●
Undertake activities to maintain the quality, safety or
integrity of the Sites or our services, including to repair, improve, upgrade,
or enhance the Sites or our services
● To conduct our operations and for other general business purposes
● To conduct audits and enable internal record keeping and administration of records
●
Maintain data security, including detecting and responding to
security incidents, protecting you and us from fraud or other illegal activity,
and prosecute individuals responsible for that activity
●
Monitor our Sites and track information about our
interactions with you, including gathering usage data and other analytic
information
● To personalize your experience when you use the Sites
●
Other uses that are required for us to meet our legal,
contractual or regulatory requirements
Sources of personal information. We collect personal information
from various sources, including the following:
●
Information that you provide
to us: We
collect personal information that you provide to us when you set up an account with
us, visit our Sites, use our services, or communicate with us. For example, if
you register for an account with us, we may request your name, contact
information and other information.
●
Information collected from
third parties:
We may collect information about you from third parties in the course of
providing our services. For example, we may collect personal information like
your name, contact information and employment status from your college or
university in order to provide you with access to our Sites and services as an
authorized user.
● Information collected through technology: When you visit our Sites or interact with an email we send to you, we may collect certain information automatically, such as your account or device identifier, and usage information such as pages that you visit, information about links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our services. You have the ability to express your preference regarding some of the ways we collect information through technology in some of our services (see “Cookies and Other Tracking Technologies” for more information).
The business purpose for our processing of personal
information.
Our primary business purpose for processing personal information about you is
to perform the services outlined in our contracts with our customers. We may
also use personal information about you to enable the following additional business
purposes: (1) detecting and managing security incidents or fraudulent activity,
(2) providing customer service, fulfilling requests, and other functions
directly related to the services, (3) maintaining our software including
debugging and repairing errors, and (4) maintaining the quality of the services
and developing enhancements and improvements to meet our customer needs. When
we rely on your consent as the legal basis for our processing of personal
information, you may withdraw your consent as may be instructed in the Sites
and Apps, or by contacting us using the information in the “
Data anonymization and aggregation. Subject to your consent if required
by law, we may anonymize or aggregate personal information about you so that
you are not identified or identifiable from it, in order to use the anonymized
or aggregated data. For example, we may use anonymized or aggregated data for
statistical analysis including to analyze trends, for product development, and
for risk assessments and cost analysis. We may disclose anonymized or
aggregated data to our parent companies, subsidiaries, affiliates or with other
third parties. This Notice does not restrict ECSI's use or disclosure of any
anonymized or aggregated information.
We disclose personal
information as necessary to operate our Sites and provide the services. Except
as otherwise specified, we may disclose any of the categories of personal
information about you in the manner and for the purposes described below:
●
With ECSI affiliates where such disclosure is necessary to
provide you with our services or to manage our business.
●
With non-affiliated service providers. For example, we
disclose personal information to information technology (IT) service providers
who help manage our back office systems or administer our Sites and services.
Non-affiliated service providers may also include (without limitation) legal,
accounting, auditing, consulting, or other professional service providers.
●
With our customer on whose behalf we interact with you in the
provision of the services. For example, ECSI may disclose the personal
information relating to customer personnel to the relevant customer, consistent
with the terms of our contractual agreement(s) with that customer.
●
With banks and payment providers to authorize and complete
card payments.
●
With logistics service providers to enable the delivery of
packages to individuals.
●
With social media management providers that enable us to
manage and analyze our branded social media account content, including tags,
mentions, posts, comments, and direct messages.
● With other non-affiliated entities to whom you direct us to disclose defined categories of personal information about you.
● With regulators including state and federal agencies, and other parties required to enable compliance with laws, regulations and industry standards related to our services.
●
In response to a court order or a request for cooperation
from a regulatory, law enforcement, or other government agency; to establish or
exercise our legal rights; to defend legal claims; or as otherwise required or
permitted by applicable laws and/or regulations.
●
When we believe that disclosure is appropriate in connection
with efforts to investigate, prevent, or take action regarding actual or
suspected illegal activity, fraud, or other wrongdoing; to protect and defend
the rights, property or safety of ECSI, its customers, staff,
suppliers or
others.
●
To third parties in connection with any proposed or actual
reorganization, merger, sale, joint venture, assignment, transfer or other
disposition of all or any portion of our assets or stock
(including in
connection with any bankruptcy or similar proceedings).
Subject to your consent if
required by applicable law, we may appoint an affiliate company to process
personal information in a service provider role. Our affiliates are located
around the globe. This means that personal information about you may be transferred
to and stored in the United States or in another country outside of the country
in which you reside, which may be subject to different standards of data
protection than your country of residence. Where applicable, we will take
appropriate steps to transfer personal information in accordance with
applicable law.
We take the security and
privacy of personal information seriously. We maintain administrative,
technical and physical safeguards designed to protect the personal information
you provide against accidental, unlawful or unauthorized destruction, loss,
alteration, access, disclosure or use.
Any suspected attempt to
breach our policies and procedures, or to engage in any type of unauthorized
action involving our information systems, is regarded as potential criminal
activity. Suspected computer mischief may be reported to the appropriate
authorities.
Please remember that
communications over the internet such as emails are not secure. We seek to keep
secure personal information submitted to us through the Sites in accordance
with our obligations under applicable laws and regulations. However, like all
website operators, we cannot guarantee the security of any data transmitted
through the internet, including the Sites.
We retain the personal
information we collect for different periods of time depending on what it is
and how we use it. In some contexts, we will provide additional information
about retention as you use the services. When we collect personal information,
we will retain it only for as long as is necessary to complete the legitimate
business or legal purposes for which we collected it. The criteria used to
determine our retention periods include:
● The length of time we have an
ongoing relationship with you and provide services to you, for example, for as
long as you have an account with us or continue to use our services, and the
length of time thereafter during which we may have a legitimate need to
reference personal information to address issues that may arise;
● Whether there is a
contractual obligation to which we are subject, for example, our contracts with
our customers may specify a certain period of time during which we are required
to maintain the information on behalf of our customers;
● Whether there is a legal
obligation to which we are subject, for example, certain laws require us to
keep records for a certain period of time before we can delete them; and
● Whether retention is
advisable in light of our legal position, such as in regard to applicable
statutes of limitations, litigation, or regulatory investigations.
A "cookie" is a
text file that is stored to your browser when you visit a website.
Unique device identifiers
like IP address or UDID recognize a visitor's computer or other device used to
access the internet. Unique device identifiers are used alone and in
conjunction with cookies and other tracking technologies for the purpose of
"remembering" computers or other devices used to access the Sites.
We may also use other
technologies like pixels or tags that allow us to measure responses to our
email communications.
Cookies and similar tracking
technologies are used to help us retain information about your use of our
Sites. Using cookies, we collect information like country location, language
preference and other settings. Cookies can also help us to operate our services
more efficiently and securely, remember you for future visits and enhance your
user experience by providing real-time tools including user guides and chatbots. We also gather statistical information about the
use of our services in order to continually improve their design and
functionality, understand how they are used, and assist us with resolving
questions regarding them.
Cookies can be classified by
duration and by source:
●
Duration. The Sites use both
"session" and "persistent" cookies. Session cookies are
temporary - they terminate when you close your browser or otherwise end your
"active" browsing session. Persistent cookies remember you on
subsequent visits. Persistent cookies are not deleted when you close your
browser, and they will remain on your computer or other device unless you
choose to delete them (see below for "How to Delete or Block Cookies and Other Tracking Technologies").
●
Source. Cookies can be
"first-party" or "third-party" cookies, which means that
they are either issued by or on behalf of ECSI or by a third-party operator of
another website. The Sites use both first-party and third-party cookies.
The cookies that we may use
on the Sites fall into the following categories:
●
Strictly Necessary Cookies. These cookies are necessary
for the website to function and cannot be switched off in our systems. They are
usually only set in response to actions taken by you such as logging in or
filling in forms. You can set your browser to block or alert you about these
cookies, but blocking them may impede the functionality of the Sites.
●
Performance Cookies. These cookies allow us to
count visits and traffic sources so we can measure and improve the performance
of our site. They help us to know which pages are the most and least popular
and see how visitors move around the site. All information these cookies
collect is aggregated. If you do not allow these cookies we will not know when
you have visited our site, and will not be able to monitor its performance.
●
Functionality Cookies. These cookies enable the
Sites to provide enhanced functionality and personalization. They may be set by
us or by third-party providers whose services we have added to our pages. If
you do not allow these cookies then some of these services may not function
properly.
● Targeting Cookies. These cookies may be set through our Sites by our advertising or other third-party partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. We do not set targeting cookies on our borrower-facing Sites.
We adhere to the standards
set out in this Notice and do not currently monitor or respond to browser
Do-Not-Track signals. If you do not want information collected through the use
of cookies, you can use the Cookie Settings banner or icon on the Site to make
selections about the use of cookies, where applicable on some Sites.
Additionally, most browsers allow you to automatically decline cookies or be
given the choice of declining or accepting a particular cookie (or cookies)
from a particular website. You may also refer to
http://www.allaboutcookies.org/manage-cookies/index.html. If, however, you do
not accept cookies, you may experience some inconvenience in your use of our
services. You also may not receive advertising from us that are relevant to
your interests and needs. Additionally, some browsers and browser extensions
support the Global Privacy Control (“GPC”) that can send a signal to the
websites you visit indicating your choice to opt out of certain types of data
processing. Through our consent management platform, administered by our vendor
OneTrust, the Sites recognize and respond to opt-out
requests made using GPC.
ECSI may provide links on our
Sites to other third-party websites or services that are not under our control.
We do not endorse or make any warranty of any type regarding the content
contained on such third-party websites or services or regarding the products
and services they offer. Please be aware that we are not responsible for the
privacy practices of the operators of other websites or services. We encourage
our users to be aware when they leave our Sites You should read any other
applicable privacy and cookies notices carefully before accessing and using
third-party websites or services.
The Sites and our services
are not directed to or intended for use by children. We do not solicit or
knowingly accept any personal information from persons under the age of 18.
Please do not use the Sites or our services if you are under the age of 18.
● Know whether we process personal information about you;
● Know how the personal information is used;
● Access, request and receive the personal information we have collected in a portable manner;
● Opt out of having personal information sold “shared”;
● Request that we correct inaccuracies in the personal information; and
● Request that we delete personal information about you.
You
may contact us using the information in the “Contact Us” section of this Notice for additional information about how
to exercise your rights. In addition, if you are a resident of California or
another jurisdiction with similar laws, please see the “Region-Specific Information” section below for further details
on how to exercise your privacy rights.
We reserve the right, in our sole discretion, to modify,
update, or otherwise change this Notice. The “Last Updated” legend at the top
of this Notice indicates when this Notice was last revised. Any changes will
become effective when we post the revised Notice on our services, including our
Sites. Where required by applicable law, to the extent we make material or
significant changes to the Notice, we will notify you of the update via a
pop-up, email, notification in the Sites, or other method through which we
communicate with you.
If you have questions about
this Notice, or if you want to exercise your rights as described in this
Notice, you can submit a request by completing this form or may contact us as
follows:
ECSI
1200 Cherrington
Pkwy, Suite 200
Moon Township, PA 15108
privacy@globalpay.com
888-549-3274
If you make a request to
exercise a privacy right, we will verify and respond to your request consistent
with applicable law, taking into account the type and sensitivity of the
personal information subject to the request. We may decline to honor your
request where an exception applies. In order to honor any access, deletion, or
similar request, we will require you to provide enough information for us to
verify your identity. For example, we may ask you for information associated
with your account, including your contact information or other identifying
information. If you would like your agent to make a request on your behalf, if
permitted under applicable law, the agent may exercise those rights as noted
above. We will process the agent’s request consistent with applicable law. As
part of our verification process, we may request that the agent provide, as
applicable, proof concerning their status as an authorized agent. In addition,
we may require that you verify your identity as described in this section or
confirm that you provided the agent permission to submit the request.
Information for Residents of
California and Other Similar Jurisdictions
This
section supplements the above Notice and further describes how we collect, use,
and disclose the personal information we collect about residents of California
and other similar jurisdictions.
|
Categories of Personal Information (See the “Personal Information We Collect and How We
Use It” section for a description of each category of Personal Information) |
Disclosed to Which Categories of Recipients for Operational Business Purposes |
Processing Purposes |
|
Basic Identifying
Information; Device Information and Other Unique Identifiers; Internet or
Other Network Activity; Commercial Information; Professional and
Employment-Related Information; Information You Provide |
Please see the “How We Disclose Personal Information” section for a list of the
categories of recipients to whom we may disclose these categories of personal
information. |
Please see the “How We Use the Personal Information We
Collect” section for a list and description of the applicable processing
purposes for these categories of personal information. |
|
Audio and Visual
Information |
Affiliates; distributors of
our products and services; service providers; regulators; legal authorities
and other third parties in order to comply with laws, regulations, and
standards; other parties in litigation |
● Provide our services and
customer support ● Operations and general
business purposes ● Improve and develop new
products and services ● Fraud prevention and
security ● Legal and compliance |
The
non-borrower-facing Sites use cookies, including some cookies that are created
by other companies and placed on your browser when you visit our website. We
use those cookies to improve your experience and to gather information about
our customers and the performance of our website. However, the companies who
provide those cookies to us also have access to the data collected through
them, and they may use that data for targeted advertising purposes. Our use of
those third-party cookies could therefore be considered a “share” of your
personal information under California law or processing for targeted
advertising under other privacy laws. If you are a resident of California or
another jurisdiction with similar laws, that means you
have the right to opt out. If you have not done so already, you can opt out of
the placement of all non-necessary cookies by adjusting your Cookie Settings.
You
can also use the GPC to indicate your choice to opt out of certain types of
data processing, including sales and “shares” of personal information. Through
our consent management platform, administered by OneTrust,
the Sites recognize and respond to opt-out requests made using GPC.
Right to know
about personal information collected, used, disclosed, sold, and “shared”
|
You have the right to know whether we process
personal information about you, and to access such personal information. If
you are a California resident, you may also request that we disclose to you:
● the
categories of personal information we have collected about you and the
categories of sources from which we collected such personal information;
● the business
or commercial purpose for which we collected, “shared,” or sold the personal
information about you;
● the categories of personal
information about you that we “shared” or sold and the categories of third
parties with whom we “shared” or to whom we sold the personal information
about you; and
● the
categories of personal information about you that we disclosed for a business
purpose, and the categories of third parties to whom we disclosed that
information for a business purpose.
|
Right to receive
a copy of personal information
|
You have the right to request that we provide
the specific pieces of personal information, including a copy of such
personal information in a portable format.
|
Right to opt-out of the sale of personal
information
|
You may request that we do not sell personal
information about you to third parties. See the “
|
Right to opt-out of targeted advertising,
including the “sharing” of personal information
for cross-context behavioral advertising
|
You may request that we opt you out of
targeted advertising, including that we stop “sharing” personal information
about you for purposes of cross-context behavioral advertising. See the “Do Not Sell or Share My Personal Information” section for
more information.
|
Right to request deletion
|
In some circumstances, you have the right to
have personal information about you deleted.
|
Right to equal service and prices (“non-discrimination”)
|
Your choice to exercise your privacy rights
will not be used as a basis to discriminate against you in services offered
or pricing.
|
Right to
request correction
|
You have the right to
request that we correct inaccuracies in your personal information.
|
Right to
limit the use and disclosure of sensitive personal information
|
In some
circumstances, you may request that we limit the use and disclosure of your
sensitive personal information.
|
Right to
appeal
|
Depending on your
state of residence, if we refuse to take action on your request, you may
appeal this refusal within a reasonable period after you have received notice
of the refusal. To appeal, you can contact us at privacy@globalpay.com or complete this form and select
“Appeal a decision about a previous request” under “Type of Request.”
|
You
can submit a request for any of the above rights by using the contact
information in the “Contact Us”
section of this Notice.
If
you are a resident of California, you may request information concerning the
categories of personal information (if any) we share with third parties or
affiliates for their direct marketing purposes. If you would like more
information, please submit a written request to us using the information
provided in the above “Contact Us” section of this Notice.